[Bug sanitizer/85774] Incorrect stack-use-after-scope caused by missing cleanup of shadow bytes

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=85774

--- Comment #9 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
So, can't we somewhere in:
              /* Find best representative of the partition.
                 Prefer those with DECL_NAME, even better
                 satisfying asan_protect_stack_decl predicate.  */
              for (j = i; j != EOC; j = stack_vars[j].next)
                if (asan_protect_stack_decl (stack_vars[j].decl)
                    && DECL_NAME (stack_vars[j].decl))
                  {
                    repr_decl = stack_vars[j].decl;
                    break;
                  }
                else if (repr_decl == NULL_TREE
                         && DECL_P (stack_vars[j].decl)
                         && DECL_NAME (stack_vars[j].decl))
                  repr_decl = stack_vars[j].decl;
              if (repr_decl == NULL_TREE)
                repr_decl = stack_vars[i].decl;
              data->asan_decl_vec.safe_push (repr_decl);
code tell the asan.c code about the whole partition, essentially
after picking up the representative, essentially do:
              if (asan_handled_variables
                  && !asan_handled_variables->contains (repr_decl))
                {
                  for (j = i; j != EOC; j = stack_vars[j].next)
                    if (asan_handled_variables->contains (stack_vars[j].decl))
                      break;
                  if (j != EOC)
                    asan_handled_variables->add (repr_decl);
                }
, i.e. if any variable in the partition was ever poisoned, make sure the
representative is unpoisoned?
Of course, asan_handled_variables is private to asan.c and EOC and the way the
vars are chained is cfgexpand.c's private thing, so it might need some wrapping
into asan.c APIs that cfgexpand.c can call.